Method, device, equipment and medium for detecting memory vulnerability in embedded operating system

Abstract

The present disclosure relates to the field of computer security technology, and specifically to a method, apparatus, device, and medium for detecting memory vulnerabilities in embedded operating systems. The method comprises: obtaining vulnerability codes of embedded operating systems of different memory vulnerability types; performing feature analysis on the vulnerability codes, and constructing a multidimensional variable information table based on the feature analysis results; constructing a memory vulnerability rule set based on the multidimensional variable information table; and performing vulnerability detection on the embedded operating system code to be detected using the memory vulnerability rule set. The above technical solution overcomes the main defects of existing static code analysis tools in processing these complex system components by introducing a multidimensional variable information table specifically for typical memory vulnerabilities in network protocol stacks, drivers, and memory operations, and constructing corresponding custom inspection rules.

Description

Technical Field

[0001] The present disclosure relates to the field of computer security technology, and in particular to a memory vulnerability detection method, apparatus, device and medium for an embedded operating system. Background Art

[0002] As embedded operating systems continue to grow in complexity, the code for key components like network protocol stacks, drivers, and memory operations has become larger and more complex. Compared to typical application software code, these operating system components involve underlying hardware interactions and system resource management, such as memory allocation and deallocation, page table management, and buffer management. This makes it highly susceptible to security vulnerabilities during development. These vulnerabilities include, but are not limited to, buffer overflows, memory leaks, double-free memory, and read-after-free. Once these vulnerabilities occur, they can severely impact system stability and security.

[0003] To detect and fix these potential security vulnerabilities early, developers often use static code analysis tools. These tools do not run the code during vulnerability analysis, but instead analyze the source code to identify possible vulnerabilities. Compared to dynamic analysis, they can perform a more comprehensive analysis of the source code.

[0004] Currently, there are a variety of static code analysis tools on the market that can detect some common security issues in code. Analysis and testing have shown that mainstream open-source static code analysis tools on the market, such as Clang Static Analyzer, Cppcheck, Infer, and Tscancode, provide some basic code security checking capabilities, capable of discovering potential defects and code compliance issues in operating system code. The open-source community version of Sonarqube does not support C# code detection and is unable to detect operating system code. Furthermore, these tools share a common characteristic: their default checking rules primarily target general programming errors, and their detection capabilities are limited for memory-related security vulnerabilities in the operating system's network protocol stack, drivers, and memory operation components. In actual testing of mainstream embedded operating systems, memory-related vulnerabilities often go undetected. Summary of the Invention

[0005] In order to solve the problems in the related art, the embodiments of the present disclosure provide a memory vulnerability detection method, apparatus, device and medium for an embedded operating system.

[0006] In a first aspect, an embodiment of the present disclosure provides a method for detecting memory vulnerabilities in an embedded operating system, comprising:

[0007] Obtain vulnerability codes for embedded operating systems of different memory vulnerability types;

[0008] Performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values;

[0009] Constructing a memory vulnerability rule set based on the multidimensional variable information table;

[0010] The memory vulnerability rule set is used to perform vulnerability detection on the embedded operating system code to be detected.

[0011] In one embodiment of the present disclosure, performing feature analysis on the vulnerability code and constructing a multidimensional variable information table based on the feature analysis results includes:

[0012] Determine the type characteristics of different memory vulnerability types;

[0013] Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

[0014] In one embodiment of the present disclosure, determining the type characteristics of different memory vulnerability types includes:

[0015] Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases;

[0016] Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

[0017] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include at least one of: variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias, and pointer usage information;

[0018] Accordingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include:

[0019] Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

[0020] In one embodiment of the present disclosure, constructing a memory vulnerability rule set based on the multidimensional variable information table includes:

[0021] Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table;

[0022] Constructing a detection rule for the corresponding memory vulnerability type based on the variable features associated with the same vulnerability type and the corresponding variable feature values;

[0023] The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

[0024] In one embodiment of the present disclosure, performing vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set includes:

[0025] Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information;

[0026] The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0027] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow, and uninitialized variable.

[0028] In a second aspect, an embodiment of the present disclosure provides a memory vulnerability detection device for an embedded operating system, comprising:

[0029] an acquisition module configured to acquire vulnerability codes of embedded operating systems of different memory vulnerability types;

[0030] A first construction module is configured to perform feature analysis on the vulnerability code and construct a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values;

[0031] A second building module is configured to build a memory vulnerability rule set based on the multidimensional variable information table;

[0032] The detection module is configured to perform vulnerability detection on the embedded operating system code to be detected using the memory vulnerability rule set.

[0033] In one embodiment of the present disclosure, the first construction module performs feature analysis on the vulnerability code and constructs a multidimensional variable information table based on the feature analysis result, and is configured as follows:

[0034] A first determining unit is configured to determine type characteristics of different memory vulnerability types;

[0035] The first construction unit is configured to perform feature analysis on embedded operating system vulnerability codes of different memory vulnerability types based on the type features, extract function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and construct a multidimensional variable information table based on the extracted information.

[0036] In one embodiment of the present disclosure, the determining unit includes:

[0037] an acquisition subunit, configured to acquire vulnerability information of memory-related vulnerabilities of the embedded operating system from a public vulnerability database;

[0038] The determination subunit is configured to analyze vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation based on the vulnerability information, and determine type characteristics of different memory vulnerability types based on the analysis results.

[0039] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include at least one of: variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias, and pointer usage information;

[0040] Accordingly, the construction unit extracts function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and is configured as follows:

[0041] Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

[0042] In one embodiment of the present disclosure, the second building block includes:

[0043] A second determining unit is configured to determine variable features associated with the same vulnerability type and corresponding variable feature values ​​from the multidimensional variable information table;

[0044] A second construction unit is configured to construct a detection rule for a corresponding memory vulnerability type based on variable features associated with the same vulnerability type and corresponding variable feature values;

[0045] The composition unit is configured to combine the constructed detection rules of the corresponding memory vulnerability types into a memory vulnerability rule set.

[0046] In one embodiment of the present disclosure, the detection module includes:

[0047] an analysis unit configured to perform feature analysis on the embedded operating system code to be detected, extract function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and construct a vulnerability analysis information table based on the extracted information;

[0048] The matching unit is configured to match the vulnerability analysis information table with the detection rules in the memory vulnerability rule set one by one, and if the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0049] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow, and uninitialized variable.

[0050] In a third aspect, an embodiment of the present disclosure provides an electronic device comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, and wherein the one or more computer instructions are executed by the processor to implement a method as described in any one of the first aspects.

[0051] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method as described in any one of the first aspects is implemented.

[0052] In a fifth aspect, an embodiment of the present disclosure provides a chip, which includes a processor, and the processor is used to call a computer program in a memory to execute the memory vulnerability detection method of the above-mentioned embedded operating system.

[0053] The technical effects provided by the embodiments of the present disclosure may include the following beneficial effects:

[0054] According to the technical solution provided by the embodiments of the present disclosure, a method for detecting memory vulnerabilities in an embedded operating system includes obtaining vulnerability code of the embedded operating system for different memory vulnerability types; performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; constructing a memory vulnerability rule set based on the multidimensional variable information table; and using the memory vulnerability rule set to perform vulnerability detection on the embedded operating system code to be detected. The above technical solution overcomes the main shortcomings of existing static code analysis tools in handling these complex system components by introducing a multidimensional variable information table specifically for typical memory vulnerabilities in network protocol stacks, drivers, and memory operations, and constructing corresponding custom inspection rules. When detecting memory-related vulnerabilities in the operating system, the constructed memory vulnerability rule set is used to detect typical memory vulnerabilities such as integer / buffer overflows and use / release confusion vulnerabilities. This method is highly targeted and practical, and can help developers locate and fix vulnerabilities more quickly, thereby improving the security and stability of the system.

[0055] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A flowchart of a memory vulnerability detection method for an embedded operating system according to an embodiment of the present disclosure is shown.

[0057] Figure 2 A schematic diagram of a vulnerability code of an uninitialized variable according to an embodiment of the present disclosure is shown.

[0058] Figure 3 A structural block diagram of a memory vulnerability detection device for an embedded operating system according to an embodiment of the present disclosure is shown.

[0059] Figure 4 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0060] Figure 5 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0061] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0062] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts, or combinations thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, actions, components, parts, or combinations thereof exist or are added.

[0063] It should also be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0064] Currently, there are a variety of static code analysis tools on the market that can detect some common security issues in code. Analysis and testing have shown that mainstream open-source static code analysis tools on the market, such as Clang Static Analyzer, Cppcheck, Infer, and Tscancode, provide some basic code security checking capabilities, capable of discovering potential defects and code compliance issues in operating system code. The open-source community version of Sonarqube does not support C# code detection and is unable to detect operating system code. Furthermore, these tools share a common characteristic: their default checking rules primarily target general programming errors, and their detection capabilities are limited for memory-related security vulnerabilities in the operating system's network protocol stack, drivers, and memory operation components. In actual testing of mainstream embedded operating systems, memory-related vulnerabilities often go undetected.

[0065] In view of the above-mentioned shortcomings, the present disclosure provides a memory vulnerability detection method for an embedded operating system, comprising obtaining vulnerability code of an embedded operating system with different memory vulnerability types; performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; constructing a memory vulnerability rule set based on the multidimensional variable information table; and performing vulnerability detection on the embedded operating system code to be detected using the memory vulnerability rule set. The above technical solution overcomes the main shortcomings of existing static code analysis tools in handling these complex system components by introducing a multidimensional variable information table specifically for typical memory vulnerabilities in network protocol stacks, drivers, and memory operations, and constructing corresponding custom inspection rules. When detecting memory-related vulnerabilities in the operating system, the constructed memory vulnerability rule set is used to detect typical memory vulnerabilities such as integer / buffer overflows and use / release confusion vulnerabilities. This method is highly targeted and practical, and can help developers locate and fix vulnerabilities more quickly, thereby improving the security and stability of the system.

[0066] Figure 1 A flowchart of a memory vulnerability detection method for an embedded operating system according to an embodiment of the present disclosure is shown.

[0067] like Figure 1 As shown, the memory vulnerability detection method of the embedded operating system includes the following steps S110-S140:

[0068] In step S110, vulnerability codes of embedded operating systems of different memory vulnerability types are obtained;

[0069] In step S120, feature analysis is performed on the vulnerability code, and a multidimensional variable information table is constructed based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values;

[0070] In step S130, a memory vulnerability rule set is constructed based on the multidimensional variable information table;

[0071] In step S140, vulnerability detection is performed on the embedded operating system code to be detected using the memory vulnerability rule set.

[0072] In embedded operating system code, memory-related security vulnerabilities in key system components such as network protocol stacks, drivers, and memory operations are crucial and determine the security and stability of the system. Typical memory vulnerability types include use and release confusion, memory leaks, integer / buffer overflows, and uninitialized variables. Existing static code analysis tools for analyzing these memory vulnerability types have the following shortcomings: static analysis tools lack an understanding of the complex pointer usage, memory allocation, and release strategies in operating system code; they cannot accurately track the lifecycle of objects, potentially missing issues such as memory leaks or double releases; they lack bounds checking for sensitive variables and cannot detect vulnerabilities such as buffer overflows and out-of-bounds memory accesses, especially when processing complex data structures (such as linked lists and trees); and many operating system codes do not initialize memory before use, making it difficult for static analysis tools to track the initialization status of variables, potentially leading to potential security vulnerabilities.

[0073] In the disclosed method, a multidimensional variable information table is constructed by analyzing the characteristics of the embedded operating system vulnerability code for at least two vulnerability types of different memory vulnerability types, such as use and release confusion, memory leaks, integer / buffer overflows, and variable uninitialization. The variable characteristics and variable characteristic values ​​in the multidimensional variable information table are extracted from the vulnerability code of different memory vulnerability types, reflecting the characteristics of different memory vulnerability types. Then, a memory vulnerability rule set is constructed based on the multidimensional variable information table. The detection rules therein can detect memory-related security vulnerabilities in key system components in the embedded operating system, overcoming the defect that existing static code analysis tools cannot detect vulnerabilities when processing these complex system components.

[0074] In the disclosed method, when constructing a multidimensional variable information table, function variables can be used as rows, and variable features corresponding to the function variables can be used as columns. The variable feature values ​​are then filled into the cells where the rows and columns intersect to obtain the multidimensional variable information table. Of course, the positions of the rows and columns can also be swapped to construct a multidimensional variable information table, and this disclosure does not impose any restrictions on this.

[0075] In the disclosed method, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and uninitialized variables.

[0076] In one embodiment of the present disclosure, performing feature analysis on the vulnerability code in step S120 and constructing a multidimensional variable information table based on the feature analysis results includes:

[0077] Determine the type characteristics of different memory vulnerability types;

[0078] Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

[0079] In the disclosed method, a memory vulnerability type often has multiple type features, and by identifying these type features, it can be determined whether the memory vulnerability type exists. In the disclosed method, the type features of the memory vulnerability type are determined by performing a feature analysis of the memory vulnerability as a whole, and then specifically analyzing the embedded operating system vulnerability code of the memory vulnerability type. The variable features corresponding to the function variables extracted therefrom are extracted with reference to the type features of the memory vulnerability type. For example, the type features of the memory vulnerability type that determines the variable is not initialized include the variable type, scope, life cycle and data flow direction. Figure 2 A schematic diagram of the vulnerability code of uninitialized variables according to an embodiment of the present disclosure is shown. When analyzing the vulnerability code of the uninitialized variables, the extracted function variable is the result variable, and then the variable characteristics of the result variable are extracted, which are the same as the type characteristics of the memory vulnerability type of the uninitialized variable, specifically including the variable type, scope, life cycle and data flow direction. The above variable characteristics and the corresponding variable characteristic values ​​are extracted, and finally the extracted result variable, the variable characteristics corresponding to the result variable and the variable characteristic values ​​are added to the multidimensional variable information table.

[0080] In one embodiment of the present disclosure, determining the type characteristics of different memory vulnerability types includes:

[0081] Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases;

[0082] Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

[0083] In the disclosed method, vulnerability information of memory-related vulnerabilities of embedded operating systems is extracted from public vulnerability databases (such as CVE vulnerability database, NVD vulnerability database, etc.), specifically including but not limited to vulnerability description, impact scope, vulnerability patch and related software version information, etc., and then the characteristics and exploitability principles of memory-related vulnerabilities are analyzed, including but not limited to: vulnerability triggering conditions (for example, specific function calls, incorrect parameter passing, pointer state confusion), typical code patterns generated by vulnerabilities such as use and release confusion, memory leaks, integer / buffer overflows and uninitialized variables, etc., and the type characteristics of different memory vulnerability types are determined based on the analysis results. In this disclosure, for the four types of memory vulnerabilities, namely use and release confusion, memory leaks, integer / buffer overflows and uninitialized variables, the determined type characteristics include at least variable type, scope, life cycle, data flow direction, constraints, pointer aliases and pointer usage information.

[0084] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include at least one of: variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias, and pointer usage information;

[0085] Accordingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include:

[0086] Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

[0087] Specifically, we use a combination of analysis tools to extract variable features corresponding to function variables as an example. The analysis tool Clang tracks the assignment, transfer, and use of function variables, obtaining variable status information, including variable type, scope, and lifecycle. The analysis tool Joern deeply traces the flow of data in the program to generate a data flow graph (DFG) and a control flow graph (CFG), and uses the DFG and CFG to determine the data flow direction. The analysis tool Frama-C obtains constraints on function variables. The analysis tool LLVM can be used to obtain pointer aliasing and pointer usage information (involving memory operations such as allocation and deallocation).

[0088] Still Figure 2 Taking the vulnerability code of uninitialized variables as an example, the variable characteristics of the detected result variable and the corresponding variable characteristic values ​​are:

[0089] Variable type: integer int type.

[0090] Scope: local variables within a function.

[0091] Lifecycle: The lifecycle of result is the entire function, but the initialization path is missing.

[0092] Data flow direction: result is the output direction in the entire function, and its status will be returned to the caller.

[0093] In one embodiment of the present disclosure, constructing a memory vulnerability rule set based on the multidimensional variable information table in step S130 includes:

[0094] Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table;

[0095] Constructing a detection rule for the corresponding memory vulnerability type based on the variable features associated with the same vulnerability type and the corresponding variable feature values;

[0096] The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

[0097] In this disclosure, we combine a multidimensional variable information table to define custom detection rules. By defining custom rules for embedded operating system code features, we can improve the detection capabilities of memory-related vulnerabilities. The rules we construct include but are not limited to the following:

[0098] Use-after-free detection rule: After detecting a memory release operation, the pointer cannot be read or written any more. If the variable is still used after being released, it will be marked as a use-after-free vulnerability.

[0099] Memory leak detection rules: Check that dynamically allocated memory is released on all possible exit paths, ensuring that pointers do not lose references and are not allocated repeatedly. If the release operation is not called in any path, it is marked as a memory leak vulnerability;

[0100] Buffer overflow detection rule: Checks the buffer size against the actual size of the stored data to ensure that out-of-bounds writes and reads do not occur. When data flows into the buffer, if it exceeds the buffer limit, it is marked as a buffer overflow vulnerability;

[0101] Uninitialized variable detection rule: Checks the initialization status of all variables before use, ensuring that all data flows (input / output) go through a complete initialization path. If a variable is used without being assigned a value in some branches, the path is flagged as a possible uninitialized vulnerability.

[0102] In one embodiment of the present disclosure, a test code library can also be used to verify the effectiveness of the memory vulnerability rule set. The test code library contains actual or simulated vulnerable code to test whether the memory vulnerability rules can correctly identify the problem. The test code library also contains vulnerability-free code to verify that the memory vulnerability rules do not generate false positives. After testing and verification, the rules can be adjusted to optimize their accuracy and reduce false positives and negatives. Rules can also be simplified to improve detection efficiency.

[0103] In one embodiment of the present disclosure, performing vulnerability detection on the embedded operating system code to be detected using the memory vulnerability rule set in step S140 includes:

[0104] Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information;

[0105] The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0106] In the disclosed method, when vulnerability detection is performed on the embedded operating system code to be detected, a vulnerability analysis information table for the embedded operating system code to be detected can be constructed with reference to the multidimensional variable information table. The variable features corresponding to the function variables included in the vulnerability analysis information table include at least the variable features in the multidimensional variable information table. For example, the vulnerability analysis information table may include variable type, scope, life cycle, data flow direction, constraints, pointer alias and pointer usage information. Then, based on the vulnerability analysis information table and the detection rules in the memory vulnerability rule set, such as the use-after-release detection rule, memory leak detection rule, buffer overflow detection rule and variable uninitialized detection rule, a one-to-one match is performed. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0107] In the disclosed method, the constructed memory vulnerability rule set can be imported into the analysis tool Clang, and the analysis tool Clang can be used to detect whether there are memory vulnerabilities in the embedded operating system code to be detected, and a detailed report can be generated, listing the context information of the violation and repair suggestions, thereby helping developers to repair potential vulnerabilities in a timely manner.

[0108] This disclosure provides a memory vulnerability detection method for embedded operating systems. This method uses techniques such as code data flow analysis to create a multidimensional variable information table, which includes information that impacts security vulnerability detection, including variable type, scope, lifecycle, data flow direction, constraints, pointer aliases, and pointer usage. This method utilizes a memory vulnerability rule set built on this multidimensional variable information table to comprehensively track and analyze memory-related security vulnerabilities in key system components. By providing detailed context and status information, developers can more quickly locate and fix vulnerabilities, thereby improving system security and stability.

[0109] Figure 3 The following is a structural block diagram of a memory vulnerability detection device for an embedded operating system according to an embodiment of the present disclosure, wherein the device can be implemented as part or all of an electronic device through software, hardware, or a combination of both.

[0110] like Figure 3 As shown, the memory vulnerability detection device 300 of the embedded operating system includes:

[0111] An acquisition module 310 is configured to acquire vulnerability codes of embedded operating systems of different memory vulnerability types;

[0112] A first construction module 320 is configured to perform feature analysis on the vulnerability code and construct a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values;

[0113] A second building module 330 is configured to build a memory vulnerability rule set based on the multi-dimensional variable information table;

[0114] The detection module 340 is configured to perform vulnerability detection on the embedded operating system code to be detected using the memory vulnerability rule set.

[0115] The technical solution provided by the disclosed embodiments overcomes the major shortcomings of existing static code analysis tools in handling these complex system components by introducing a multidimensional variable information table specifically targeting typical memory vulnerabilities in network protocol stacks, drivers, and memory operations, and constructing corresponding custom inspection rules. When detecting memory-related vulnerabilities in the operating system, the constructed memory vulnerability rule set is used to detect typical memory vulnerabilities such as integer / buffer overflows and use / release confusion. This highly targeted and practical approach helps developers locate and fix vulnerabilities more quickly, thereby improving system security and stability.

[0116] In one embodiment of the present disclosure, the first construction module performs feature analysis on the vulnerability code and constructs a multidimensional variable information table based on the feature analysis result, and is configured as follows:

[0117] A first determining unit is configured to determine type characteristics of different memory vulnerability types;

[0118] The first construction unit is configured to perform feature analysis on embedded operating system vulnerability codes of different memory vulnerability types based on the type features, extract function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and construct a multidimensional variable information table based on the extracted information.

[0119] In one embodiment of the present disclosure, the determining unit includes:

[0120] an acquisition subunit, configured to acquire vulnerability information of memory-related vulnerabilities of the embedded operating system from a public vulnerability database;

[0121] The determination subunit is configured to analyze vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation based on the vulnerability information, and determine type characteristics of different memory vulnerability types based on the analysis results.

[0122] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include at least one of: variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias, and pointer usage information;

[0123] Accordingly, the construction unit extracts function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and is configured as follows:

[0124] Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

[0125] In one embodiment of the present disclosure, the second building block includes:

[0126] A second determining unit is configured to determine variable features associated with the same vulnerability type and corresponding variable feature values ​​from the multidimensional variable information table;

[0127] A second construction unit is configured to construct a detection rule for a corresponding memory vulnerability type based on variable features associated with the same vulnerability type and corresponding variable feature values;

[0128] The composition unit is configured to combine the constructed detection rules of the corresponding memory vulnerability types into a memory vulnerability rule set.

[0129] In one embodiment of the present disclosure, the detection module includes:

[0130] an analysis unit configured to perform feature analysis on the embedded operating system code to be detected, extract function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and construct a vulnerability analysis information table based on the extracted information;

[0131] The matching unit is configured to match the vulnerability analysis information table with the detection rules in the memory vulnerability rule set one by one, and if the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0132] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow, and uninitialized variable.

[0133] The present disclosure also discloses an electronic device, Figure 4 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0134] like Figure 4 As shown, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to an embodiment of the present disclosure.

[0135] The memory vulnerability detection method of the embedded operating system includes:

[0136] Obtain vulnerability codes for embedded operating systems of different memory vulnerability types;

[0137] Performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values;

[0138] Constructing a memory vulnerability rule set based on the multidimensional variable information table;

[0139] The memory vulnerability rule set is used to perform vulnerability detection on the embedded operating system code to be detected.

[0140] In one embodiment of the present disclosure, performing feature analysis on the vulnerability code and constructing a multidimensional variable information table based on the feature analysis results includes:

[0141] Determine the type characteristics of different memory vulnerability types;

[0142] Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

[0143] In one embodiment of the present disclosure, determining the type characteristics of different memory vulnerability types includes:

[0144] Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases;

[0145] Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

[0146] In one embodiment of the present disclosure, the variable characteristics corresponding to the function variable include at least one of: variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias, and pointer usage information;

[0147] Accordingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include:

[0148] Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

[0149] In one embodiment of the present disclosure, constructing a memory vulnerability rule set based on the multidimensional variable information table includes:

[0150] Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table;

[0151] Constructing a detection rule for the corresponding memory vulnerability type based on the variable features associated with the same vulnerability type and the corresponding variable feature values;

[0152] The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

[0153] In one embodiment of the present disclosure, performing vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set includes:

[0154] Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information;

[0155] The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

[0156] In one embodiment of the present disclosure, the different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow, and uninitialized variable.

[0157] Figure 5 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown.

[0158] like Figure 5 As shown, the computer system includes a processing unit that can execute the various methods of the above-described embodiments based on a program stored in a read-only memory (ROM) or a program loaded from a storage unit into a random access memory (RAM). The RAM also stores various programs and data required for the operation of the computer system. The processing unit, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0159] The following components are connected to the I / O interface: an input section including a keyboard, mouse, etc.; an output section including a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section including a hard disk; and a communication section including a network interface card such as a LAN card and a modem. The communication section performs communication processes via a network such as the Internet. A drive is also connected to the I / O interface as needed. Removable media such as magnetic disks, optical disks, magneto-optical disks, semiconductor memories, etc. are installed in the drive as needed, so that computer programs read from them can be installed in the storage section as needed. The processing unit can be implemented as a CPU, GPU, TPU, FPGA, NPU, or other processing unit.

[0160] In particular, according to embodiments of the present disclosure, the methods described above can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising program code for executing the methods described above. In such embodiments, the computer program can be downloaded and installed from a network via a communication component and / or installed from a removable medium.

[0161] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of code, and the module, program segment or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0162] The units or modules involved in the embodiments described in this disclosure may be implemented by software or programmable hardware. The units or modules described may also be provided in a processor, and the names of these units or modules do not, in certain circumstances, constitute limitations on the units or modules themselves.

[0163] As another aspect, the present disclosure further provides a chip, which includes at least one processor and can be used to implement the method involved in the above system embodiment.

[0164] In one possible design, the chip further includes a memory for storing program instructions and data, and the memory is located inside or outside the processor.

[0165] As another aspect, the present disclosure further provides a computer-readable storage medium. This computer-readable storage medium may be included in the electronic device or computer system described in the above embodiments, or may be a standalone computer-readable storage medium not incorporated into the device. The computer-readable storage medium stores one or more programs, which are used by one or more processors to execute the methods described in the present disclosure.

[0166] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention herein is not limited to technical solutions formed by specific combinations of the aforementioned technical features. It also encompasses other technical solutions formed by any combination of the aforementioned technical features or their equivalents, without departing from the inventive concept. For example, a technical solution formed by replacing the aforementioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

Claims

1. A memory vulnerability detection method for an embedded operating system, characterized in that: include: Obtain vulnerability codes for embedded operating systems of different memory vulnerability types; Performing feature analysis on the vulnerability code, and constructing a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; Constructing a memory vulnerability rule set based on the multidimensional variable information table; The memory vulnerability rule set is used to perform vulnerability detection on the embedded operating system code to be detected.

2. The memory vulnerability detection method according to claim 1, wherein: The performing feature analysis on the vulnerability code and constructing a multi-dimensional variable information table based on the feature analysis results includes: Determine the type characteristics of different memory vulnerability types; Based on the type features, feature analysis is performed on embedded operating system vulnerability codes of different memory vulnerability types, function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values ​​are extracted, and a multidimensional variable information table is constructed based on the extracted information.

3. The memory vulnerability detection method according to claim 2, wherein: The type features for determining different memory vulnerability types include: Obtain vulnerability information of embedded operating system memory-related vulnerabilities from public vulnerability databases; Based on the vulnerability information, vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation are analyzed, and type characteristics of different memory vulnerability types are determined based on the analysis results.

4. The memory vulnerability detection method according to claim 2, wherein: The variable characteristics corresponding to the function variable include: at least one of variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias and pointer usage information; Accordingly, the function variables of different memory vulnerability types are extracted, and the variable features and variable feature values ​​corresponding to the function variables include: Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

5. The memory vulnerability detection method according to claim 1, wherein: The constructing of a memory vulnerability rule set based on the multidimensional variable information table includes: Determine variable features and corresponding variable feature values ​​associated with the same vulnerability type from the multidimensional variable information table; Constructing a detection rule for the corresponding memory vulnerability type based on the variable features associated with the same vulnerability type and the corresponding variable feature values; The constructed detection rules for the corresponding memory vulnerability types are combined into a memory vulnerability rule set.

6. The memory vulnerability detection method according to claim 1, wherein: The method of using the memory vulnerability rule set to perform vulnerability detection on the embedded operating system code to be detected includes: Performing feature analysis on the embedded operating system code to be detected, extracting function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and constructing a vulnerability analysis information table based on the extracted information; The vulnerability analysis information table is matched one by one with the detection rules in the memory vulnerability rule set. If the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

7. The memory vulnerability detection method according to claim 1, wherein: The different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and variable uninitialization.

8. A memory vulnerability detection device for an embedded operating system, characterized in that: include: an acquisition module configured to acquire vulnerability codes of embedded operating systems of different memory vulnerability types; A first construction module is configured to perform feature analysis on the vulnerability code and construct a multidimensional variable information table based on the feature analysis results, wherein the multidimensional variable information table records function variables corresponding to different vulnerability types, variable features corresponding to the function variables, and variable feature values; A second building module is configured to build a memory vulnerability rule set based on the multidimensional variable information table; The detection module is configured to perform vulnerability detection on the embedded operating system code to be detected by using the memory vulnerability rule set.

9. The memory vulnerability detection device according to claim 8, characterized in that: The first construction module performs feature analysis on the vulnerability code and constructs a multi-dimensional variable information table based on the feature analysis result, and is configured to: A first determining unit is configured to determine type characteristics of different memory vulnerability types; The first construction unit is configured to perform feature analysis on embedded operating system vulnerability codes of different memory vulnerability types based on the type features, extract function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and construct a multidimensional variable information table based on the extracted information.

10. The memory vulnerability detection device according to claim 9, characterized in that: The first determining unit includes: an acquisition subunit, configured to acquire vulnerability information of memory-related vulnerabilities of the embedded operating system from a public vulnerability database; The determination subunit is configured to analyze vulnerability triggering conditions of different memory vulnerability types and typical code patterns of vulnerability generation based on the vulnerability information, and determine type characteristics of different memory vulnerability types based on the analysis results.

11. The memory vulnerability detection device according to claim 9, wherein: The variable characteristics corresponding to the function variable include: at least one of variable type, scope, life cycle, data flow direction, constraint conditions, pointer alias and pointer usage information; Accordingly, the first construction unit extracts function variables of different memory vulnerability types, variable features corresponding to the function variables, and variable feature values, and is configured as follows: Utilize analysis tools or a combination of analysis tools to extract variable features and variable feature values ​​corresponding to function variables of corresponding memory vulnerability types.

12. The memory vulnerability detection device according to claim 8, wherein: The second building block includes: A second determining unit is configured to determine variable features associated with the same vulnerability type and corresponding variable feature values ​​from the multidimensional variable information table; A second construction unit is configured to construct a detection rule for a corresponding memory vulnerability type based on variable features associated with the same vulnerability type and corresponding variable feature values; The composition unit is configured to combine the constructed detection rules of the corresponding memory vulnerability types into a memory vulnerability rule set.

13. The memory vulnerability detection device according to claim 8, wherein: The detection module includes: an analysis unit configured to perform feature analysis on the embedded operating system code to be detected, extract function variables, variable features corresponding to the function variables, and variable feature values ​​in the embedded operating system code to be detected, and construct a vulnerability analysis information table based on the extracted information; The matching unit is configured to match the vulnerability analysis information table with the detection rules in the memory vulnerability rule set one by one, and if the match is successful, it indicates that a memory vulnerability of the corresponding memory vulnerability type exists.

14. The memory vulnerability detection device according to claim 8, wherein: The different memory vulnerability types include at least one or more of the following types: use and release confusion, memory leak, integer / buffer overflow and variable uninitialization.

15. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 1 to 7.

16. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

17. A chip, characterized in that: include: At least one processor, configured to implement the method according to any one of claims 1 to 7.

Images